Graph api add member on mail enabled group “Unable to update the specified properties for objects that have originated within an external service.”

问题

I've been trying to write an MVC application that uses the Graph api to administrate AD Groups. The problem I'm running into is when I try to add or remove users to Mail enabled security groups I get "Unable to update the specified properties for objects that have originated within an external service." These operations work fine with "normal" Security groups. According to the docs it should support both, what am I missing?

Code:

bool userAdded = false;
        GraphServiceClient graphClient = GetAuthenticatedClient();
        try
        {
            var user = await graphClient.Users[userId].Request().GetAsync();
            await graphClient.Groups[groupId].Members.References.Request).AddAsync(user);
            Debug.WriteLine("Added user " + userId + " to the group: " + groupId);
            userAdded = true;
        }

回答1:

Mail-enabled security groups cannot currently be updated directly in Azure AD, they are managed either from on-premises (if you're syncing from an on-premises directory with Azure AD Connect), or from Exchange Online.

来源：https://stackoverflow.com/questions/39869247/graph-api-add-member-on-mail-enabled-group-unable-to-update-the-specified-prope